Hi,
I just received a TP-Link WA-1201(EU) v3, but currently there is only an image for WA-1201 v2.
Does anyone know the hardware differences between the two versions? Would it be possible to install v2 firmware on v3 hardware?
Thanks.
So assuming its not possible to use the v2 images on a v3, I took a look at the TP-link OEM firmware images to see if I could detect hardware differences.
The v2 image is based on OpenWrt, whereas the first part of the OEM image for V3 is a UBoot image.
However, binwalk is not able to extract any filesystems from the images embedded in v3 OEM image. Does anyone know to to do that. I was hoping to understand if there are differences in the partition layout before I try uploading the OpenWrt image for V2 onto V3 hardware.
Is there a way to extract the root fs of the V3 OEM image (See output from binwalk below). Unfortunatly binwalk -Me <image name> is not able to extract the filesystem.
I am hoping to avoid soldering a serial connection (Partly being afraid to destroy the hardware, and also because I'm not sure I have the hardware needed, (Serial ttl?)). But I'm willing to do quite some debugging to get OpenWrt running on the router.
Binwalk output for V2 OEM image:
8212 0x2014 uImage header, header size: 64 bytes, header CRC: 0xB433A287, created: 2022-01-03 08:27:01, image size: 1046133 bytes, Data Address: 0x80060000, Entry Point: 0x80060000, data CRC: 0x3029FBF2, OS: Linux, CPU: MIPS, image type: Multi-File Image, compression type: lzma, image name: "MIPS OpenWrt Linux-3.3.8"
8284 0x205C LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 3032844 bytes
1054410 0x1016CA Squashfs filesystem, little endian, version 4.0, compression:xz, size: 8857426 bytes, 1254 inodes, blocksize: 65536 bytes, created: 2022-01-03 08:29:07
9912054 0x973EF6 XML document, version: "1.0"
9922899 0x976953 gzip compressed data, from Unix, last modified: 2022-01-03 08:29:13
9930120 0x978588 gzip compressed data, from Unix, last modified: 2022-01-03 08:29:13
9937403 0x97A1FB gzip compressed data, from Unix, last modified: 2022-01-03 08:29:13
9944634 0x97BE3A gzip compressed data, from Unix, last modified: 2022-01-03 08:29:13
Binwalk output for V3 OEM image:
148 0x94 uImage header, header size: 64 bytes, header CRC: 0xA221C466, created: 2021-10-22 03:28:56, image size: 37802 bytes, Data Address: 0x41C00000, Entry Point: 0x41C00000, data CRC: 0x87565B96, OS: Firmware, CPU: ARM, image type: Standalone Program, compression type: lzma, image name: "U-Boot 2014.04-rc1 for leopard_e"
212 0xD4 LZMA compressed data, properties: 0x5D, dictionary size: 67108864 bytes, uncompressed size: -1 bytes
38016 0x9480 LZMA compressed data, properties: 0x6E, dictionary size: 8388608 bytes, uncompressed size: 3221248 bytes
1238372 0x12E564 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
1434325 0x15E2D5 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
1520839 0x1734C7 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
1571047 0x17F8E7 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
1637363 0x18FBF3 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
1657856 0x194C00 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
1688723 0x19C493 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
1718880 0x1A3A60 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
1748793 0x1AAF39 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
1776217 0x1B1A59 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
1803820 0x1B862C LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
1832913 0x1BF7D1 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
1867423 0x1C7E9F LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
1894203 0x1CE73B LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
1923469 0x1D598D LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
1951066 0x1DC55A LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
1979943 0x1E3627 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2008009 0x1EA3C9 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2035343 0x1F0E8F LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2063013 0x1F7AA5 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2166222 0x210DCE LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2193882 0x2179DA LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2222242 0x21E8A2 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2250209 0x2255E1 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2277053 0x22BEBD LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2301841 0x231F91 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2329232 0x238A90 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2354327 0x23EC97 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2384953 0x246439 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2415510 0x24DB96 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2441154 0x253FC2 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2538912 0x26BDA0 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2559646 0x270E9E LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2570672 0x2739B0 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2591751 0x278C07 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2614373 0x27E465 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2663515 0x28A45B LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2687359 0x29017F LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2707485 0x29501D LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2737235 0x29C453 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2777078 0x2A5FF6 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2804404 0x2ACAB4 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2836214 0x2B46F6 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2863579 0x2BB1DB LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
So, I received the "V2" today - or no, they sent the V3 and have not V2 left. So my first time hacking a Router starts now.
I used binwalk -e to extract the LZMA parts, they are packed again, so you would have to recursively extract files in files in files. It's a like a giant onion. After 1 hour, I gave up and heated up the soldering iron and put in a little terminal for serial. Sadly, the UART did not talk to me. I maybe have the wrong adapter, I just have a RS232 to USB adapter, not explicitly UART, so I ordered one here in Germany, hopefully, it arrives on Friday.
I will continue to give infos on it, maybe anpefu also soldered in a terminal.
But heads up: I have no idea how to make an image, so I need help with that. Drivers and filesystem infos are needed I guess. So as soon as possible, I will write a V3 article with the Hardware for others.
No I have not gotten terminal access to the device, as I don't think the device can be supported by OpenWrt.
According to the FCC filing for WA1201V3, its based on completely different hardware compared to V2:
From the Photos, the CPU is an TPLink TP1900BN which properly only has 4 MB flash which is too little for OpenWrt to run smoothly. This is further backed by the OEM firmware sizes:
V2: 9,5MB
V3: 2.8MB
The Wifi chipsets has also changed to Mediatek MT7761N and MT7762N. The ethernet port is driven by RTL8211FS
But I'd be happy to be proven wrong, esp. on the flash size, but my hopes of this device being supported by OpenWrt is low.
While I cannot blame hardware vendors to optimize the cost of existing products, the V3 should really have been marketed under a different model name, as its totally different from the V2.
I didn't look at the specs, but the uncompressed size of the image says 32mb or do I remember it wrongly ? I will receive my Uart adapter tomorrow, then I'll have a look on Saturday or maybe tomorrow evening.
It would be sad if it would be impossible to install Openwrt on it and I would sent it back for a refund, telling them why. But it's a possibility
I hope that you are right, but usually base images in flash is compressed and decompressed at runtime when reading (at least that's the case with squashfs). I was just looking at the size of wa1201v3-up-noboot_2022-01-18_10.16.38.bin and compared it to the OEM firmware image for the V2.
Today, the UART Adapter arrived and I couldn't wait. Sadly, not good news.
I misread the size and it's not 32MB, it's 3.2MB. It was shown as bytes, so I miscounted the digits.
The firmware itself is something strange called "Software Platform for TPOS/1.0.0", looks like a pretty scaled down *nix system. The flash is nailed to 3852K with a few extra flash areas for the config.
Here is the Serial Output. I think, this time, we won't win.
I'll contact sales and sent it back, not desoldering the pins, maybe, somebody gets it and is happy to see them, but unhappy of my little note inside "OpenWRT not possible"
Maybe they sent me a V2? Who knows? I will also contact TP-Link about it and how it's misleading imho.